Prometheus exporter for Keenetic routers (RCI API). This repository has the container image and the Helm chart.
| Tag | What it is |
|---|---|
latest | Latest image build |
<git sha> (e.g. 446729b) | Image built from that commit |
<semver> (e.g. 0.2.1) | Helm chart (OCI artifact, not a runnable image) |
Images are built for linux/amd64, linux/arm64 and linux/arm/v7.
gcr.io/distroless/static-debian12:nonroot: no shell, runs as
UID/GID 65532.10062. Metrics are at /metrics and a health check is at
/healthz.HEALTHCHECK (the binary's healthcheck subcommand).docker run -d -p 10062:10062 \
-e KEENETIC_ENDPOINT=http://192.168.1.1 \
-e KEENETIC_USERNAME=exporter \
-e KEENETIC_PASSWORD=secret \
dev0nizer/keenetic-exporter
To keep the password out of the environment, mount it as a file and set
KEENETIC_PASSWORD_FILE:
services:
keenetic-exporter:
image: dev0nizer/keenetic-exporter
ports: ["10062:10062"]
environment:
KEENETIC_ENDPOINT: http://192.168.1.1
KEENETIC_USERNAME: exporter
KEENETIC_PASSWORD_FILE: /run/secrets/keenetic_password
secrets: [keenetic_password]
secrets:
keenetic_password:
file: ./keenetic_password
| Variable | Required | Description |
|---|---|---|
KEENETIC_ENDPOINT | yes | Router URL, e.g. http://192.168.1.1 |
KEENETIC_USERNAME | yes | Router user |
KEENETIC_PASSWORD | yes* | Password |
KEENETIC_PASSWORD_FILE | * | File holding the password |
EXPORTER_PORT | no | Port to listen on, default 10062 |
KEENETIC_TIMEOUT | no | Router API timeout, default 10s |
KEENETIC_INCLUDE_INACTIVE_CLIENTS | no | Also export offline clients, default false |
LOG_LEVEL | no | debug, info (default), warn, error |
* Set either KEENETIC_PASSWORD or KEENETIC_PASSWORD_FILE. If a required
setting is missing, the container exits with an error.
Router user: don't use the admin account. Create a user with only the Web Interface and Prohibit saving system settings permissions.
Keep the scrape interval under 5 minutes. The router ends idle sessions after 5 minutes, and each new login adds 2 requests to the scrape.
The chart is published as an OCI artifact in this repository.
kubectl create secret generic keenetic-router \
--from-literal=username=exporter --from-literal=password=secret
helm install keenetic-exporter oci://registry-1.docker.io/dev0nizer/keenetic-exporter \
--version 0.2.1 \
--set keenetic.endpoint=http://192.168.1.1 \
--set keenetic.existingSecret=keenetic-router
Show all values with
helm show values oci://registry-1.docker.io/dev0nizer/keenetic-exporter --version 0.2.1.
| Value | Default | Description |
|---|---|---|
keenetic.endpoint | "" | Router URL (required) |
keenetic.existingSecret | "" | Existing Secret with the username and password |
keenetic.existingSecretUsernameKey | username | Username key in that Secret |
keenetic.existingSecretPasswordKey | password | Password key in that Secret |
keenetic.username, keenetic.password | "" | Used only without existingSecret; the chart then creates the Secret |
keenetic.timeout | 10s | Router API timeout |
keenetic.includeInactiveClients | false | Also export offline clients |
logLevel | info | Log level |
image.tag | chart appVersion | Image tag |
port | 10062 | Container and Service port |
serviceMonitor.enabled | false | Create a prometheus-operator ServiceMonitor |
serviceMonitor.interval | 30s | Scrape interval (keep under 5 minutes) |
serviceMonitor.labels | {} | Labels to match your Prometheus serviceMonitorSelector |
podScrapeAnnotations | false | Add prometheus.io/* annotations for annotation-based discovery |
resources | 10m CPU, 16Mi request; 64Mi limit | Pod resources |
The pod always reads the credentials from a Secret. It runs with a restricted security context (non-root, read-only root filesystem, no capabilities). The chart always runs one replica, because each replica would scrape the router.
Content type
Image
Digest
sha256:d90aa1d10…
Size
4 MB
Last updated
5 days ago
docker pull dev0nizer/keenetic-exporter